Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use zizmor to audit github actions #1775

Open
notmandatory opened this issue Dec 14, 2024 · 0 comments · May be fixed by #1778
Open

Use zizmor to audit github actions #1775

notmandatory opened this issue Dec 14, 2024 · 0 comments · May be fixed by #1778
Assignees
@oleonardolima
Labels
ci

Comments

@notmandatory
Copy link
Member

Describe the enhancement

We should audit github actions to make sure an attacker can't publish compromised bdk-ffi binaries.

see: https://discord.com/channels/753336465005608961/754077749282471937/1317184034010435625

Use case

See documentation for zizmor.

Additional context

This auditing should also be done on other bitcoindevkit org repos. In particular bdk-ffi, see: bitcoindevkit/bdk-ffi#638.
@notmandatory notmandatory added this to BDK Dec 14, 2024
@notmandatory notmandatory moved this to Todo in BDK Dec 14, 2024
@oleonardolima oleonardolima self-assigned this Dec 14, 2024
@oleonardolima oleonardolima linked a pull request Dec 16, 2024 that will close this issue
Draft
8 tasks
@notmandatory notmandatory moved this from Todo to In Progress in BDK Dec 18, 2024
@notmandatory notmandatory mentioned this issue Dec 18, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@oleonardolima oleonardolima

Labels
ci
Projects
BDK
Status: In Progress
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ci: apply zizmor security audit oleonardolima/bdk
2 participants
@notmandatory @oleonardolima